I have visualforce page that displays information from custom object. I get id from the url and do SOQL query in controller. Client wants to send the link to this page (hosted on Salesforce site). What is the best practices for record id? I'm not sure that is good solution to provide link like site.force.com/your_page?id=salesforce_id because we are sending original Salesforce id of the record.
For the most part, exposing an ID is completely harmless. The limited exception I'd place on that rule are 00DXXXXXXXXXXXX Id values, which can allow spammers to hit your web-to-lead or web-to-case queues if enabled. Even salesforce.com uses ID values in various places, such as Help & Training, the Developer Forums, etc. For example, here's a question (picked at random) from the Developer Forums:
However, what is important is to make sure your code runs "with sharing", so that the user can't query or modify a record they shouldn't have access to, and make sure your security model (OWD, FLS, profiles, sharing rules, etc) are correctly configured.